An access log is a recorded trail of activity showing when a user, process, or device reached a system, application, or file. It can include timestamps, source IPs, account names, actions taken, and whether the attempt succeeded or failed.
In cyber security, access logs matter because they help prove whether data was actually opened, copied, modified, or only targeted. Defenders use them to investigate alerts, confirm scope, detect unusual logins, and build timelines after a breach. Attackers often try to delete, alter, or avoid logging because intact logs can expose their presence and methods. In incident response, access logs are most useful when combined with file activity, authentication records, and endpoint telemetry to separate claims from evidence and to verify what was truly touched.